Skip to main content
Information Security for Workload Factory

How AWS credentials flow through NetApp Workload Factory

Contributors netapp-rlithman
PDFs

The AWS credential flow describes how NetApp Workload Factory handles role identifiers, external IDs, and short-lived AWS STS credentials during onboarding and runtime operations. During one-time setup, you create an IAM role in your AWS account and configure a trust policy that requires the Workload Factory service principal and the correct external ID. At runtime, Workload Factory uses the stored role ARN and external ID to request temporary credentials scoped by a per-request session policy, and it reuses cached credentials until they expire.

One-time setup

For a one-time setup, the flow is as follows:

Steps

  1. You launch a CloudFormation stack or manually create an IAM role in your AWS account.

  2. The IAM role trust policy specifies two conditions:

    1. Only the service principal for Workload Factory can assume it.

    2. The caller must present the correct external ID.

  3. Workload Factory stores the role ARN and external ID (encrypted) in its database.

Runtime (every API operation)

At runtime, Workload Factory uses the stored role ARN and external ID to obtain temporary AWS STS credentials for each API operation. The flow is as follows:

Steps

  1. Workload Factory retrieves the stored role ARN and external ID from MySQL.

  2. It checks Redis for a cached set of temporary AWS STS credentials for this role.

  3. On a cache miss, Workload Factory calls sts:AssumeRole with the role ARN and external ID. The call includes a per-request inline session policy that restricts permissions to only the specific AWS actions needed for that operation.

  4. AWS STS returns temporary credentials (access key ID, secret access key, session token) with an expiration timestamp.

  5. Workload Factory caches these credentials in Redis and uses them to call the target AWS APIs.

  6. On cache hit, Workload Factory skips the STS call and uses the cached credentials directly.

Session policy

Each STS call includes an inline session policy scoped to the minimum AWS actions required.